# Should I include the ciphertext length in an AAD when using Chacha20+Poly1205 AEAD?

I want to construct a time-limited authorization token using ChaCha20 and Poly1305 as defined by RFC7539. I chose the following simple layout:

version || nonce || ciphertext || Poly1305 tag
1B         12B      *B            16B


where the concatenation of version and nonce is used as the Poly1305's AAD.

However, this scheme does not explicitly specify the length of the ciphertext to follow, so an attacker may want to try to truncate or expand the ciphertext section of the token. If I add the ctlength value between version and nonce, will it improve security?

    mac_data |= num_to_4_le_bytes(ciphertext.length)